Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16/03/2024, 10:31
General
-
Target
2024-03-16_4ec398301b9d177e5fb8e3a6ace5844f_cryptolocker.exe
-
Size
106KB
-
MD5
4ec398301b9d177e5fb8e3a6ace5844f
-
SHA1
d22271dae44a20224d9107b2706e0063499bc82a
-
SHA256
e9c58fdccbfa96e8676db6d2e869d0f5b516ef7d843baa5f738dd71698772128
-
SHA512
522b67172dcfcf20047bb45f4efb454474a4bb8a9383f441880f94d36072f6613f4ad4769b1808151700edad530fd82a4525b9a3a2ad8854d201143d4a26d645
-
SSDEEP
1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalRn5iF1j6Gksas:1nK6a+qdOOtEvwDpjt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_4ec398301b9d177e5fb8e3a6ace5844f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_4ec398301b9d177e5fb8e3a6ace5844f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD5492094119ff571f6b1c88e321014a513
SHA1feeb6a4d5260cdafb52ba4194174d490d70bb93d
SHA256704378d744579c339c1802a38de32a42fdace2ac8535a957361101a4c28f56fa
SHA512d910aaeb5a417de46a4f77c58ffc6388116d07b80815ecf949919c4de39062db5ec0fe69cc1f76d751eb2db1e6663ec47ea849dc37f963c901fc261959c7c444
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
64KB